All of lore.kernel.org
 help / color / mirror / Atom feed
From: Tetsuo Handa <penguin-kernel@I-love.SAKURA.ne.jp>
To: syzbot <syzbot+8281086e8a6fbfbd952a@syzkaller.appspotmail.com>,
	axboe@kernel.dk, linux-block@vger.kernel.org,
	syzkaller-bugs@googlegroups.com
Subject: Re: [syzbot] KASAN: use-after-free Read in bdev_free_inode
Date: Sun, 19 Sep 2021 22:37:34 +0900	[thread overview]
Message-ID: <41766564-08cb-e7f2-4cb2-9ad102f21324@I-love.SAKURA.ne.jp> (raw)
In-Reply-To: <0000000000004a5adf05cc593ca9@google.com>

This seems to be kfree() before RCU grace period.

struct block_device *bdev_alloc(struct gendisk *disk, u8 partno)
{
	struct block_device *bdev;
	struct inode *inode;

	inode = new_inode(blockdev_superblock);
	if (!inode)
		return NULL;
	inode->i_mode = S_IFBLK;
	inode->i_rdev = 0;
	inode->i_data.a_ops = &def_blk_aops;
	mapping_set_gfp_mask(&inode->i_data, GFP_USER);

	bdev = I_BDEV(inode);
	mutex_init(&bdev->bd_fsfreeze_mutex);
	spin_lock_init(&bdev->bd_size_lock);
	bdev->bd_disk = disk; // <= Assigns pointer to "disk".
	bdev->bd_partno = partno;
	bdev->bd_inode = inode;
	bdev->bd_stats = alloc_percpu(struct disk_stats);
	if (!bdev->bd_stats) {
		iput(inode); // <= Will call bdev_free_inode() via i_callback() after RCU from destroy_inode() from evict() from iput_final() from iput().
		return NULL;
	}
	return bdev;
}

struct gendisk *__alloc_disk_node(struct request_queue *q, int node_id,
		struct lock_class_key *lkclass)
{
	struct gendisk *disk;

	if (!blk_get_queue(q))
		return NULL;

	disk = kzalloc_node(sizeof(struct gendisk), GFP_KERNEL, node_id);
	if (!disk)
		goto out_put_queue;

	disk->bdi = bdi_alloc(node_id);
	if (!disk->bdi)
		goto out_free_disk;

	disk->part0 = bdev_alloc(disk, 0);
	if (!disk->part0)
		goto out_free_bdi;

	disk->node_id = node_id;
	mutex_init(&disk->open_mutex);
	xa_init(&disk->part_tbl);
	if (xa_insert(&disk->part_tbl, 0, disk->part0, GFP_KERNEL))
		goto out_destroy_part_tbl;

	rand_initialize_disk(disk);
	disk_to_dev(disk)->class = &block_class;
	disk_to_dev(disk)->type = &disk_type;
	device_initialize(disk_to_dev(disk));
	inc_diskseq(disk);
	disk->queue = q;
	q->disk = disk;
	lockdep_init_map(&disk->lockdep_map, "(bio completion)", lkclass, 0);
#ifdef CONFIG_BLOCK_HOLDER_DEPRECATED
	INIT_LIST_HEAD(&disk->slave_bdevs);
#endif
	return disk;

out_destroy_part_tbl:
	xa_destroy(&disk->part_tbl);
	iput(disk->part0->bd_inode); // <= The same race problem exists?
out_free_bdi:
	bdi_put(disk->bdi);
out_free_disk:
	kfree(disk); // <= Releasing "disk" despite "disk->part0->bd_disk == disk" when bdev_free_inode() will dereference ->bd_disk after RCU.
out_put_queue:
	blk_put_queue(q);
	return NULL;
}


  reply	other threads:[~2021-09-19 13:37 UTC|newest]

Thread overview: 9+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2021-09-19 13:35 syzbot
2021-09-19 13:37 ` Tetsuo Handa [this message]
2021-09-19 14:44   ` [PATCH] block: genhd: fix double kfree() in __alloc_disk_node() Tetsuo Handa
2021-09-20  6:40     ` Christoph Hellwig
2021-09-20  8:02       ` Tetsuo Handa
2021-09-20  8:05         ` Christoph Hellwig
2021-09-20  8:31           ` [PATCH v2] " Tetsuo Handa
2021-09-20  8:40             ` Christoph Hellwig
2021-10-09  4:53 ` [syzbot] KASAN: use-after-free Read in bdev_free_inode syzbot

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:
  https://en.wikipedia.org/wiki/Posting_style#Interleaved_style

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \
    --in-reply-to=41766564-08cb-e7f2-4cb2-9ad102f21324@I-love.SAKURA.ne.jp \
    --to=penguin-kernel@i-love.sakura.ne.jp \
    --cc=axboe@kernel.dk \
    --cc=linux-block@vger.kernel.org \
    --cc=syzbot+8281086e8a6fbfbd952a@syzkaller.appspotmail.com \
    --cc=syzkaller-bugs@googlegroups.com \
    --subject='Re: [syzbot] KASAN: use-after-free Read in bdev_free_inode' \
    /path/to/YOUR_REPLY

  https://kernel.org/pub/software/scm/git/docs/git-send-email.html

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

This is an external index of several public inboxes,
see mirroring instructions on how to clone and mirror
all data and code used by this external index.